New annual pricing

Standard annual pricing per license will be:

Customers with legacy Premium pricing will receive a 40% increase to their current rate.

Premium volume discounts will continue

If you protect multiple websites with Wordfence Premium, volume discounts will continue to apply to new purchases and renewals. With the new $199 annual base price, the standard volume pricing will be:

For new purchases, your discount is based on the active Premium licenses already in your account plus the licenses you’re buying. For renewals, it is based on your active license count at the time of renewal. Expired licenses do not count toward the active total.

For example, purchasing three Premium licenses at the new pricing qualifies you for a 10% discount: $179.10 per license, or $537.30 for one year. If you already have three active Premium licenses and purchase three more, the combined count of six qualifies the three new licenses for the 15% discount, bringing their annual price to $169.15 each.

Sign in before purchasing so your existing licenses can be included in the discount calculation. See our Premium license help page for details about volume discounts and license management.

Renew early at current pricing

You can renew eligible licenses up to one year before their expiration dates. Renew before December 3, 2026, to take advantage of current pricing.

This also applies to licenses originally purchased for multiple years once they are within one year of expiration. Premium renewals add one year of coverage; a license with more than a year remaining is not yet eligible for early renewal.

Review your subscriptions and renew now.

Why we’re making this change

The threat landscape has changed profoundly in the past few years. It is now possible for an attacker to use an open weight model like GLM 5.3 or DeepSeek 4.1 Flash, to rapidly develop and deploy exploits we have never before seen, of very high complexity, at massive scale. Attackers can even use open models that have guardrails, by obliterating those models, to allow requests that would normally be refused.

To stay ahead of the threat landscape, we have invested heavily in private cyber access programs with OpenAI and Anthropic, and use those in concert with open weight models. We have invested in R&D to build our own harnesses which include products like Argus, which as you can tell from our research, is producing impressive results. We’ve also developed PRISM and Eclipse to improve triage speed and vulnerability discovery across the broader WordPress ecosystem.

We’re also continually improving the Wordfence plugin, including adding passkey support for secure, passwordless sign-in. Alongside our ongoing threat research, these improvements help website owners strengthen security while making everyday protection easier to use.

These investments are non-negotiable and essential for us to make, given our position and role in securing WordPress. We continue to believe in WordPress as the best choice for content management on the Web, and we continue to believe in an open Web. So we are doing our part to ensure that future.

These price increases support our ongoing investment in threat research, threat intelligence and our team, our products, and our services.

Thank you for supporting that work and for trusting Wordfence to help keep your websites secure.

The Wordfence Team

The post Wordfence Price Increase Coming December 3, 2026 appeared first on Wordfence.

This is not a vulnerability in WordPress Core, a plugin, or a theme. However, WordPress can ask the server to retrieve data from other websites, and the server may use Brotli when it processes the response. A public proof of concept uses WordPress’s unauthenticated XML-RPC pingback feature to reach the vulnerable library.

The Wordfence Threat Intelligence team reproduced remote code execution in an isolated WordPress lab and tested how well the public exploit transferred between closely related server configurations. This article explains what we confirmed, what the test does and does not prove, and what WordPress site owners should do.

What is Brotli, and what does it have to do with WordPress?

Brotli is a compression format and software library used to make web content smaller and faster to transfer. It is commonly supplied by the operating system, hosting platform, container image, web server, or another part of the software stack. Site owners may use it without ever seeing “Brotli” in the WordPress dashboard.

Brotli can be used for both incoming and outgoing web traffic. In the demonstrated WordPress attack, the dangerous data is not carried directly in the request sent to the site. Instead, WordPress makes an outbound request to an attacker-controlled server, and the vulnerable Brotli library processes the compressed response.

Because Brotli is installed and updated separately from WordPress, updating WordPress will not replace the affected library. The hosting provider or server administrator must install the relevant operating-system or platform update, then restart or redeploy any services that loaded the old library.

What the vulnerability does

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder. In plain terms, a malicious compressed file can make the decoder write data outside the area of memory reserved for it. The result may be a crash, disclosure of information from memory, or remote code execution.

Google’s CVE record lists affected upstream versions on all platforms. However, simply finding Brotli on a server does not prove that the site is remotely exploitable; attacker-controlled compressed data must reach an affected decoder through the website or another exposed service.

The first fixed releases for Brotli’s maintained upstream branches are:

Linux and hosting vendors often backport security fixes without changing the main upstream version number. For example, Debian 13 fixed the issue in libbrotli1 1.1.0-2+deb13u1, even though the package still begins with 1.1.0. Check the complete package revision and the vendor’s security notice rather than comparing only the first three version numbers.

On October 27, 2026, CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog. Its public entry does not identify the affected application, victim, attack route, or outcome, and it does not say whether WordPress was involved.

How the demonstrated WordPress attack works

The public proof of concept uses a normal WordPress feature to make the site retrieve a malicious compressed response:

1. An unauthenticated request calls the pingback.ping method at xmlrpc.php and supplies a source URL controlled by the attacker.
2. WordPress retrieves that URL to confirm that it links to a real post on the site.
3. The attacker’s server returns a specially crafted response marked as Brotli-compressed.
4. The vulnerable Brotli decoder corrupts memory. If the exploit matches the server’s software and memory layout, the attacker can run code with the permissions of the website’s PHP process.

The demonstrated route requires more than an affected library. The XML-RPC endpoint must be reachable, pingback.ping must be registered, the target post must accept pings, the server must be allowed to make the outbound request, and the affected Brotli decoder must be used by the HTTP client. As currently published, the exploit must also closely match the target’s PHP build, runtime environment, and memory layout.

xmlrpc.php is the trigger used by this proof of concept, not a requirement of the Brotli vulnerability itself. Other software can expose the same decoder to attacker-controlled compressed data. In our scoped review of stock WordPress Core, pingback.ping was the clear unauthenticated route that lets an attacker supply a public URL. The other candidate URL-fetching features we examined required authentication, additional permissions, or prior content control. Plugins and themes may add other routes.

What Wordfence testing found

We reproduced the public proof of concept in isolated containers using its exact target environment: WordPress 7.1.3 on Debian 13.7 with Apache 2.4.69, PHP 8.3.36 running as mod_php, and Debian’s vulnerable libbrotli1 1.1.0-2+b7 package. Standard operating-system memory randomization was enabled.

The unauthenticated request executed code in the vulnerable lab. After we updated only Brotli to Debian’s fixed package, the same sequence no longer executed code and the server remained healthy.

The same payload did not execute against PHP 8.3.35. In one vulnerable WordPress environment, it instead crashed the PHP worker. This shows that the PHP version alone does not predict the outcome: differences in the exact build and runtime can determine whether a payload executes code, causes a crash, or fails.

Attackers can often identify WordPress, PHP, the web server, XML-RPC availability, and some outbound request behavior remotely. Those clues could help them select a payload prepared for a common server image. However, ordinary web requests do not normally reveal the exact binary build or memory layout needed to adapt this payload to an arbitrary server, and we did not demonstrate that capability.

Our current assessment is that the public exploit is not a universal request. Targeted exploitation or reuse against sites that share the same server image remains plausible. That may make indiscriminate attacks less reliable, but confirmed code execution, observed attack attempts, and CISA’s catalog entry make patching urgent.

What is known about exploitation in the wild

Multiple security companies have observed malicious targeting. ELLIO captured an exploit attempt aimed at an official Node.js build, but the captured payload did not produce a shell in 50 replays against a matching vulnerable target. Previdian continues to observe exploitation attempts, including activity on November 2, and states that its telemetry does not show whether targets were vulnerable or whether the attempts succeeded. Check Point reported automated scanning and suspicious payloads, but not confirmed compromise.

Imperva and ELLIO separately demonstrated code execution against vulnerable Node.js builds in controlled labs. These results confirm that the vulnerability can be exploited beyond WordPress, but they are not evidence of production compromise. As of November 2, 2026, we found no independently reviewable public report documenting a successful production compromise or a compromise through the WordPress XML-RPC route. CISA’s public catalog entry does not disclose the affected application, attack route, or supporting incident details, so the absence of a public case does not mean that no exploitation has occurred.

How to check whether your site may be affected

The WordPress version shown in Tools > Site Health cannot answer this question. Brotli is normally outside WordPress and may be supplied by the host, operating system, container image, PHP stack, or another bundled component.

Managed-hosting customers should ask their provider:

Is the process serving my WordPress site using a Brotli decoder patched for CVE-2026-111497, and were all affected services restarted or redeployed after the update?

Technical administrators can use XML-RPC’s unauthenticated system.listMethods method to check whether pingback.ping is registered. That check is safe, but it proves only that the method is available—not that the site is exploitable. The post must also accept pings and the server must meet the other conditions described above. WordPress’s Settings > Discussion option for pingbacks changes the default for future posts; existing posts may retain their earlier setting.

A note for Wordfence users

Wordfence’s Disable XML-RPC authentication option does not disable unauthenticated pingbacks. WordPress documents that the similarly named xmlrpc_enabled filter also affects only methods that require authentication; it does not disable pingback.ping.

Changing XML-RPC or pingback behavior may disrupt legitimate integrations and removes only the demonstrated WordPress route. It does not repair the vulnerable Brotli library. Installing the vendor’s security update remains essential.

What WordPress site owners should do

• Managed-hosting customers: Ask the hosting provider to confirm that every Brotli copy used by the site contains the CVE-2026-111497 fix and that affected services were restarted or redeployed.
• Self-managed server administrators: Install the security update supplied by the operating-system or platform vendor. Compare the complete package revision, then restart Apache, PHP-FPM, or any other process that loaded the old library.
• Container users: Rebuild and redeploy from an updated base image. Restarting an existing container does not replace the vulnerable files inside it.
• CloudLinux and similar platform users: Check the vendor advisory carefully. A server may contain separate system, web-server, or bundled PHP copies of Brotli, and updating one copy may not update the others.
• Agencies and hosting providers: Review every production, staging, and legacy environment. Do not assume that one package check covers every PHP pool, container, or server image.
• Preserve logs and backups: Because public exploit details and observed attack attempts are available, and CISA lists the vulnerability as known exploited, retain available web-server, PHP, process, firewall, and outbound-network logs from before public disclosure through the time each environment was patched and restarted.
• Investigate unusual activity: If patching was delayed, look for unexpected XML-RPC pingback requests, unusual outbound connections, and PHP or web-server crashes and restarts. These signs are not proof by themselves, and their absence does not prove that exploitation did not occur.

If an investigation finds evidence of compromise, contain the affected system before rotating database credentials, API keys, WordPress salts, and other secrets available to the website. Routine secret rotation is not a substitute for patching, and it should follow a proper incident-response assessment.

Conclusion

CVE-2026-111497 is a critical vulnerability in Brotli, not WordPress, but WordPress can provide a path to the vulnerable decoder. Our lab testing confirmed unauthenticated code execution on an exact server environment. The current public payload is not universal, but matching payloads may be reusable across standardized server images, and attackers are already testing the vulnerability in the wild. Successful production compromise through WordPress has not been publicly established, but the available evidence supports treating the update as urgent.

Do not treat configuration dependence as a reason to delay. Install the fixed package or image supplied by the relevant vendor, restart or redeploy every affected service, and verify the complete package revision used by the website.

Wordfence Care and Wordfence Response customers can contact our incident response team if they believe a site may have been compromised. Wordfence Response provides 24/7/365 availability with a one-hour response time.

If you know someone who manages WordPress sites, please share this article and ask them to confirm that the Brotli library used by each site has been patched.

Sources

• Google CNA record for CVE-2026-111497
• Brotli 1.2.1 security release
• Upstream Brotli security fix
• CISA Known Exploited Vulnerabilities catalog entry
• Debian security tracker for CVE-2026-111497
• Ubuntu security notice USN-8956-1
• Amazon Linux security advisory ALAS2023-2026-3334
• CloudLinux Brotli advisory
• WordPress pingback.ping implementation
• WordPress xmlrpc_enabled documentation
• WordPress guidance for disabling trackbacks and pingbacks
• Public WordPress proof of concept for CVE-2026-111497
• Tenable overview of the HTTP2Shell, Brotli2Shell, and Node2Shell names
• ELLIO analysis of a captured exploit attempt and controlled Node.js exploitation
• Previdian CVE-2026-111497 attempt telemetry
• Check Point HTTP2Shell research and observed activity
• Imperva controlled Node2Shell exploitation research

The post HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites appeared first on Wordfence.

TL;DR: WordPress 7.1.4 was released on October 28, 2026. According to WordPress, it includes fixes for 22 security vulnerabilities. The most serious is an unauthenticated race condition in the Core update process that can lead to remote code execution. Threat actors are already actively attempting to exploit it, so site owners should verify that WordPress has updated to 7.1.4 or the corresponding security release for their branch.

Wordfence Premium, Care, and Response customers received a new firewall rule on October 28, roughly three hours after the release. Wordfence Free users will receive the same rule after the standard 30-day delay, on November 27, 2026.

WordPress 7.1.4 is a security release addressing a broad set of issues in WordPress Core, including stored cross-site scripting, denial of service, information disclosure, authorization weaknesses, and a race condition that can result in remote code execution.

The remote code execution vulnerability stands out because it does not require an account on the site. However, successful exploitation requires an attacker to hit a very narrow window while WordPress is unpacking a complete Core update. In normal lab environments, that window was observed to last only seconds. Attackers are nevertheless polling vulnerable paths repeatedly in an effort to catch it.

Most WordPress sites should receive the security release through automatic background updates, but we strongly recommend checking your site rather than assuming the update completed. Go to Dashboard > Updates and confirm that your site is running WordPress 7.1.4 or the corresponding patched release for its branch.

Wordfence Firewall Protection

The Wordfence Threat Response Team deployed a new blocking firewall rule on October 28, 2026, at 20:30 UTC, approximately three hours after WordPress announced the security release. Wordfence Premium, Wordfence Care, and Wordfence Response customers received the rule immediately. Wordfence Free users will receive it on November 27, 2026, following the standard 30-day delay.

Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

WordPress Core 4.7.0 – 7.1.3 – Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

8.1

CVSS Rating
8.1 (High)

Affected Version(s)
Various

Patched Versions
4.7.39, 4.8.34, 4.9.35, 5.0.31, 5.1.28, 5.2.30, 5.3.27, 5.4.25, 5.5.24, 5.6.23, 5.7.21, 5.8.19, 5.9.20, 6.0.18, 6.1.16, 6.2.15, 6.3.14, 6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4

Affected Software

WordPress [wordpress]

Researcher

Umut Bayram

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

More Details >

During a Core update that uses a complete WordPress package, affected versions unpack the new files into a predictable directory beneath wp-content/upgrade. That temporary copy includes the WordPress installer. Because the staging directory is web-accessible on many servers, an unauthenticated attacker who requests the installer at precisely the right moment can interact with the staged WordPress copy and progress to PHP code execution.

The severity reflects the eventual impact: successful exploitation can give an attacker the ability to execute code on the server. The attack complexity is high, though. The attacker needs a full-package update containing the installer files, public web and PHP access to the staging tree, a predictable or discovered staging path, and enough time to complete the attack before WordPress cleans up the temporary files.

Most importantly, the attacker must win the race. In lab environments, the vulnerable staging directory normally remained available for only seconds. This narrow window makes a one-off request unlikely to succeed, but repeated automated polling can improve an attacker’s chances.

WordPress 7.1.4 addresses the issue by randomizing the staging directory, adding an index guard, and preventing unsafe promotion of staged configuration data. The fix was also backported to affected branches through WordPress 4.7.

Active Exploitation Is Already Underway

Wordfence telemetry shows that threat actors are already actively attempting to exploit the vulnerability. The first match for our new firewall rule arrived nine minutes after deployment. During the first 21 hours, we recorded more than 18,500 requests targeting staged setup-config.php installer paths.

Two of the largest sources repeatedly polled small groups of sites for roughly 14.5 hours, behavior consistent with trying to catch the brief upgrade window. Other sources tested many staging-directory and version-name variations. Not every request used the exact vulnerable path, but the sustained polling and exact-layout probes show that attackers quickly understood the race condition and began targeting it.

Other Security Fixes in WordPress 7.1.4

The detailed WordPress 7.1.4 release documentation counts 22 vulnerabilities. In addition to the upgrade-window RCE, the release addresses:

• Multiple stored cross-site scripting vulnerabilities involving block delimiters, the Categories block, Comments Pagination and Post Navigation labels, Customizer selective refresh, personal data erasure requests, specially crafted usernames, and Image and Playlist block handling.
• Several Interactivity API issues, including unsafe URL, event-handler, internal-property, and object bindings; prototype pollution; Script Module data shadowing; uploaded text-file handling in the Interactivity Router; and a persistent denial of service condition.
• An unauthenticated information disclosure issue that could expose unpublished Customizer changesets.
• An authorization weakness in the Notes REST API affecting custom roles that can moderate comments but cannot edit the post to which a note is attached.
• An update to bundled root certificates following the eMudhra revocation.

Many of the remaining vulnerabilities require an authenticated Contributor, Author, or Editor account, and several also require a victim to view attacker-controlled content. Those prerequisites reduce their exposure compared with the unauthenticated RCE, but they do not make the issues harmless. Stored cross-site scripting can lead to account takeover or site changes when a privileged user views a malicious page.

What WordPress Site Owners Should Do

1. Verify that WordPress has updated. Install WordPress 7.1.4 or the corresponding security release for your branch. WordPress 4.6 and earlier no longer receive security updates and should be upgraded to a supported release.
2. Confirm that the Wordfence Firewall is enabled and optimized. Extended Protection is important for the most serious vulnerability in this release because the malicious request goes directly to a PHP file without loading WordPress first.
3. Do not rely on the firewall instead of patching. The firewall reduces exposure while you update, but installing the fixed Core version removes the vulnerable behavior.
4. Review suspicious upgrade-directory activity if your site remained unpatched. Look for unexpected requests to PHP files beneath wp-content/upgrade, unfamiliar administrator accounts, unexpected plugins, or PHP files you did not place there.
5. Run a Wordfence scan after updating. This can identify unexpected Core changes, malicious files, and other signs that require investigation.

Conclusion

WordPress 7.1.4 is an important security release. Its most serious vulnerability can lead to unauthenticated remote code execution, but only during a narrow race window while a complete Core update is being unpacked. Attackers are already polling sites repeatedly in an effort to catch that moment.

Wordfence Premium, Wordfence Care, and Wordfence Response customers received our firewall rule on October 28, 2026. Wordfence Free users will receive the same protection on November 27, 2026. Sites using Wordfence should verify that Extended Protection is enabled, and every site owner should confirm that WordPress has been updated to a patched release.

We thank Umut Bayram for responsibly reporting the upgrade-window vulnerability, the WordPress Security Team for coordinating the release, and all of the researchers whose work made WordPress 7.1.4 possible.

Sign up for the Wordfence mailing list to receive important WordPress security news and vulnerability reports as soon as they are published.

The post WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release appeared first on Wordfence.

In July 2026, the Wordfence Bug Bounty Program received 1077 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat Intelligence team, with validated vulnerabilities responsibly disclosed to vendors, often through the Wordfence Vulnerability Management Portal – a free service for all WordPress vendors, and protected through the Wordfence Firewall where appropriate.

Our mission with the Wordfence Bug Bounty Program is to engage the broader security community in identifying and responsibly disclosing vulnerabilities in WordPress plugins and themes, so we can work with vendors to get them patched before attackers discover them. This collaborative effort enables Wordfence to accelerate patch adoption, provide early protection to millions of websites, and ensure that high-quality vulnerability intelligence reaches the WordPress ecosystem as efficiently as possible. It also ensures that we are able to remediate vulnerabilities before attackers are able to discover them and start exploiting them. That is why we reward researchers for valid submissions, and why we remain committed to processing every report with transparency, accuracy, and urgency.

As the most comprehensive and highest-quality WordPress vulnerability program, the Wordfence Bug Bounty Program plays a critical role in helping site owners, developers, and hosting providers stay ahead of emerging threats at all stages of the open source lifecycle.

In this report, we highlight key metrics of the Bug Bounty Program from July 2026, recognize the researchers contributing to WordPress security, and provide insight into the vulnerabilities uncovered and addressed.

Table of Contents
Program Submission Highlights – July 2026
WordPress Software Vulnerability Submission Insights – July 2026
Bounty Insights – July 2026
Top WordPress Security Researchers – July 2026
Current WordPress Bug Bounty Program Promotions
Critical WordPress Software Vulnerability Highlights – July 2026
Conclusion

If you’re interested in joining the program or learning more about how we responsibly manage disclosures and protect WordPress users, visit the Bug Bounty Program page.

WordPress Software Vendors – Sign Up For Free Centralized Management of all Vulnerabilities in Your Software

---

Wordfence provides a completely free vulnerability management portal for WordPress Software vendors to easily track and manage all vulnerabilities submitted to the Wordfence Bug Bounty Program, and added to the Wordfence Intelligence Vulnerability Database.

This portal streamlines and enhances the repsonsible disclosure process so you can secure your customers faster.

Get Started With the Vendor Portal Today

 

---

Program Submission Highlights – July 2026

The Wordfence Bug Bounty Program is designed for momentum: rapid triage of critical issues, clear feedback, and fast, fair rewards. Each submission moves through our standardized workflow of validation, vendor coordination, patch verification, and firewall coverage where applicable, so research translates into real-world protection quickly.

Real-Time Protection Impact

---

Every vulnerability disclosed through this program is a threat you don’t have to face blindly. Our researchers uncover and report vulnerabilities before they can be exploited, and Wordfence Premium, Care and Response users get protection in real-time through our firewall. Free users are protected in 30 days.

Behind the numbers is meaningful impact for site owners. The issues surfaced here inform new firewall rules, strengthen our detection logic, and help vendors ship safer releases. If you’re new to bounty hunting, this is a great place to start: we publish scope clearly, pay promptly, and credit the work that keeps WordPress secure.

Total Submissions

1077

+1.0% from last month

Active Researchers

281

-8.2% from last month

High Threat

84

+44.8% from last month

Common & Dangerous

73

+62.2% from last month

WAF Rules Released

15

+114.3% from last month

 

Vulnerability Focus Areas

---

• High Threat Vulnerabilities: Issues that could result in full site compromise, such as Arbitrary File Uploads or Remote Code Execution. Must be exploitable by unauthenticated or low-level authenticated attackers with software having 25+ active installations.
• Common & Dangerous: Stored Cross-Site Scripting and SQL Injection vulnerabilities exploitable by unauthenticated or low-level authenticated attackers. Software must have 500+ active installations.

---

Bounty Insights – July 2026

Our research powers real investment back into the community. This section totals bounties and bonuses paid for the month and showcases standout findings. Our philosophy is simple: reward high-quality, responsibly disclosed research that measurably reduces risk for WordPress users.

Total Bounties Awarded

$51,183

July 2026

Average Bounty Per Submission

$210.63

Per validated in-scope submission

Highest Single Bounty

$15,600

Top researcher reward

---

Top 5 Bounties Awarded

Vulnerability	Bounty	Install Count
Elementor Pro <= 4.2.1 – Unauthenticated Arbitrary File Upload via Upload Field Array Validation Bypass	$15,600.00	5,000,000
Forminator Forms <= 1.56.1 – Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration	$2,048.00	600,000
User Profile Builder <= 3.16.4 – Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via ‘username’ Parameter	$975.00	40,000
Independent Analytics <= 2.15.0 – Unauthenticated Stored Cross-Site Scripting	$804.00	100,000
Unlimited Elements For Elementor <= 2.0.16 – Unauthenticated SQL Injection	$800.00	300,000

Want to earn more? Read the scope carefully, target high-threat classes, and include clear reproduction steps with proof of impact. We pay promptly on validated issues, and bonus multipliers may apply during limited-time promotions and challenges.

---

WordPress Software Vulnerability Submission Insights – July 2026

This section breaks down how reports map to our program outcomes. What’s in scope, what isn’t, and where the highest security impact typically sits. We highlight the most common in-scope vulnerability classes and the categories that yielded the largest rewards so researchers can focus their efforts where they matter most.

Authentication level and exploit preconditions drive risk and reward through our program. Unauthenticated and low-privilege paths tend to have outsized impact because they scale to more real-world compromise. Use these insights to prioritize your testing strategy and maximize both security value and bounty potential.

---

Total Number of Vulnerabilities Considered In Scope, Out of Scope, Rejected, or Duplicate

In Scope	Out of Scope	Rejected	Duplicate
243	17	610	207

---

Top 10 Most Commonly Submitted In-Scope Vulnerability Types

The most frequently submitted vulnerability types highlight current testing focus areas across the researcher community. These patterns often reflect both ease of discovery and prevalence in the WordPress ecosystem.

Vulnerability Type	Total Submissions	Total Rewards	Avg. Reward
CWE 79: Improper Neutralization of Input During Web Page Generation	80	$13,415.00	$167.69
CWE 434: Unrestricted Upload of File with Dangerous Type	18	$21,909.00	$1,217.17
CWE 89: Improper Neutralization of Special Elements used in an SQL Command	18	$2,968.00	$164.89
CWE 269: Improper Privilege Management	16	$3,245.00	$202.81
CWE 22: Improper Limitation of a Pathname to a Restricted Directory	10	$2,825.00	$282.50
CWE 287: Improper Authentication	11	$1,213.00	$110.27
CWE 639: Authorization Bypass Through User-Controlled Key	9	$816.00	$90.67
CWE 862: Missing Authorization	9	$724.00	$80.44
CWE 94: Improper Control of Generation of Code	3	$121.00	$40.33
CWE 288: Authentication Bypass Using an Alternate Path or Channel	2	$277.00	$138.50

 

---

Top 10 Highest Rewarded In-Scope Vulnerability Types

While some vulnerabilities appear frequently, others command premium rewards. This breakdown shows which vulnerability classes generated the highest total payouts across all submissions in those categories, indicating both severity and exploitability value.

Vulnerability Type	Total Rewards	Total Submissions	Avg. Reward
CWE 434: Unrestricted Upload of File with Dangerous Type	$21,909.00	18	$1,217.17
CWE 79: Improper Neutralization of Input During Web Page Generation	$13,415.00	80	$167.69
CWE 269: Improper Privilege Management	$3,245.00	16	$202.81
CWE 89: Improper Neutralization of Special Elements used in an SQL Command	$2,968.00	18	$164.89
CWE 22: Improper Limitation of a Pathname to a Restricted Directory	$2,825.00	10	$282.50
CWE 287: Improper Authentication	$1,213.00	11	$110.27
CWE 704: Incorrect Type Conversion or Cast	$975.00	1	$975.00
CWE 639: Authorization Bypass Through User-Controlled Key	$816.00	9	$90.67
CWE 862: Missing Authorization	$724.00	9	$80.44
CWE 502: Deserialization of Untrusted Data	$615.00	1	$615.00

---

In-Scope Vulnerability Distribution by Authentication Level

Authentication requirements directly impact real-world exploitability. Unauthenticated and subscriber-level vulnerabilities typically pose greater risk, reflected in both our prioritization and reward structure.

Authentication Level	Total Vulnerabilities	Avg. Reward
Unauthenticated	163	$350.84
Subscriber	60	$133.37
Unauthenticated – UI Required	14	$74.00
Custom	4	$19.67

 

---

Vulnerability Submission Install Count Spread

Install counts help us gauge blast radius. Higher install bases can move a finding into higher priority and often correlate with stronger payouts, while smaller-but-critical ecosystems still qualify when the exploitability and impact warrant it.

Install Range	Total Vulnerabilities	Average CVSS	Avg. Reward
1,000–49,999	81	7.4	$147.53
100,000–999,999	38	7.0	$384.87
Off-Repo	31	9.0	$871.60
0–499	23	9.2	$24.64
500–999	20	7.6	$57.05
50,000–99,999	17	7.1	$134.54
1,000,000–4,999,999	1	7.2	$672.00

 

---

Top WordPress Security Researchers – July 2026

Security is a team sport, and this leaderboard celebrates the people raising the bar. We recognize contributors by valid in-scope submissions, overall earnings, and average severity to highlight different paths to excellence.

---

Top 5 Researchers based on Volume of In-Scope Submissions

Volume leaders demonstrate consistent vulnerability discovery across diverse targets. These researchers excel at systematic testing and maintaining high validation rates.

Researcher	Total Submissions	Avg. Reward
daroo	19	$574.26
d.v4n_s3c	10	$281.30
theviper17y	9	$67.89
Supakiad S. (m3ez)	8	$294.38
Jonah Burgess (CryptoCat)	8	$70.75

---

Top 5 Researchers Based on Average CVSS of In-Scope Submissions

Quality over quantity defines these researchers who consistently identify high-severity vulnerabilities. Their average CVSS scores reflect expertise in finding critical security gaps.

Researcher	Average CVSS	Total Submissions	Avg. Reward
0xd4rk5id3	9.8	2	$33.00
Talal Nasraddeen	9.8	1	$228.00
Tin Pham (TF1T)	9.8	1	$488.00
Adam Rayyan Aryasatya	9.8	2	$179.00
t4g0	9.8	1	$455.00

---

Top 5 Researchers Based On Total Bounties Earned

Combining volume with severity, these top earners maximized their impact and rewards through strategic vulnerability research and comprehensive reporting.

Researcher	Total Earned	Total Submissions	Avg. Reward
Austin Ginder	$15,810.00	3	$5,270.00
daroo	$10,911.00	19	$574.26
d.v4n_s3c	$2,813.00	10	$281.30
Supakiad S. (m3ez)	$2,355.00	8	$294.38
Adrien Brunner	$1,718.00	8	$214.75

---

Researchers Promoted to the Next Tier

Congratulations to the following researchers who have unlocked the next tier! Tier promotions reflect sustained performance, precision, and professionalism in disclosure. Advancing unlocks higher caps, faster reviews, and more visibility. If you’re climbing the ranks, focus on high risk vulnerabilities, keep reports crisp, attach working PoCs, and include mitigation notes vendors can ship quickly.

Elite Researcher Tier (1337)

0 researchers advanced to elite status

No Elite Researcher Promotions

No researchers advanced to elite (1337) status this month

Resourceful Researcher Tier

0 researchers advanced to resourceful status

No Resourceful Researcher Promotions

No researchers advanced to resourceful status this month

---

Current WordPress Bug Bounty Program Promotions

As part of our Bug Bounty Program, we regularly launch special promotions that boost bounty rewards and expand research scope. These initiatives are designed to reinforce our mission: delivering the highest quality vulnerability intelligence while encouraging researchers to focus on the discoveries that have the greatest positive impact on the WordPress ecosystem.

At the same time, we also look for promotions that give researchers opportunities to sharpen their skills, take on new challenges, and continue growing into the best of the best in WordPress security research. We often supplement these with educational material for researchers to learn and apply their skills during these promotions.

Below, you’ll find details on all currently active challenges—including timelines and a quick overview of each promotion.

No promotions currently running.

New to promotions? Start by confirming the software and version range are in scope, validate exploitability on a clean test environment, and submit with clear steps, affected code paths, and impact. Promotions are perfect opportunities for both new and seasoned researchers to maximize earnings while driving faster patch adoption. And remember, you can always check what’s in-scope and out-of-scope by using the Wordfence bounty estimator.

---

Critical WordPress Software Vulnerability Highlights – July 2026

These case studies spotlight high-impact vulnerabilities uncovered through the program, why they matter, and how quickly protection rolled out. We share technical detail to help researchers learn, vendors harden code, and users understand why timely updates aren’t optional.

If you maintain a site, update to the patched versions listed and ensure Wordfence is active so you benefit from new firewall coverage as it ships. If you’re a researcher, use these write-ups to inform your hunt: patterns repeat, and past root causes often reappear in adjacent code.

WP2Shell WordPress Exploit Technical Analysis and Real Attack Data

WordPress Core 6.9 – 7.0.1 – Remote Code Execution via REST API Batch Request Route Confusion

Found by:
Adam Kues

Bounty Awarded:
N/A

Technical Details:

WordPress Core is vulnerable to Remote Code Execution in all versions 6.9 to 7.0.1 via the REST API batch request endpoint (/wp-json/batch/v1). This is due to a route/validation desynchronization that allows a validated sub-request to be dispatched to an unintended callback, bypassing the allow_batch restriction, with attacker-controlled parameters and the target route’s input sanitization bypassed, which can be chained with SQL Injection. This may make it possible for attackers to execute code on the server.

Read the complete vulnerability analysis

 

Wordfence PRISM Detected Backdoored WordPress Plugin within Two Hours of it Being Introduced

Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 – 10.8.8 – Unauthenticated Authentication Bypass via Hardcoded Backdoor in ‘_wplogin’ Parameter

Submitted by:
Wordfence PRISM

Bounty Awarded:
N/A

Technical Details:

The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in versions 10.8.7 and 10.8.8. The vulnerability exists because the `_arve_uc_init()` function — registered on WordPress’s `init` hook at priority 1 so that it runs before any authentication checks on every request — reads an attacker-supplied token from the `_wplogin` (or `_wpm`) parameter and compares it against a hardcoded SHA-256 hash embedded directly in the plugin source, with no nonce verification, no capability check, and no password validation anywhere in the flow. Because this static hash constitutes a set of universal credentials that are publicly accessible in the plugin’s source code, unauthenticated attackers can supply the known token to be authenticated as an arbitrarily selected existing administrator account, gaining full administrative control over the affected WordPress site. This was likely introduced by an attacker who gained commit access to the developers account.

Read the complete vulnerability analysis

 

wp2shell Aftermath: The First Critical Unauthenticated WordPress Core RCE in Nearly a Decade

The First Critical Unauthenticated WordPress Core RCE in Nearly a Decade

Submitted by:
N/A

Bounty Awarded:
N/A

Technical Details:

On Friday, July 17, 2026, the WordPress Security Team released security updates for WordPress Core addressing two vulnerabilities that, when chained together, can lead to unauthenticated remote code execution. The chain, now commonly referred to as wp2shell , was discovered and reported by Adam Kues of Assetnote / Searchlight Cyber , and we want to thank him for his work and responsible disclosure.

WordPress released patched versions 6.8.6 , 6.9.5 , and 7.0.2 on July 17. The WordPress release notes describe the update as addressing one critical and one high severity security issue, and state that forced automatic updates were enabled for affected versions due to the severity of the issue.

Read the complete vulnerability analysis

 

---

Conclusion

WordPress thrives when researchers, vendors, hosts, and site owners pull in the same direction. By funding high-quality research, coordinating responsible disclosure, and shipping firewall rules at scale, Wordfence turns findings into protection for millions of sites.

If you’re a researcher, join the program and submit your next report. If you’re a site owner, update early and often, and run Wordfence to stay ahead of emerging threats. If you’re a vendor, sign up for the vulnerability management portal to receive real-time notifications when new vulnerabilities are reported in your software. Together, we make the WordPress ecosystem safer.

The post Wordfence Bug Bounty Program Monthly Report – July 2026 appeared first on Wordfence.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, and webhook integration are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.

Enterprises, Hosting Providers, and even Individuals can utilize the vulnerability Database API to receive a complete dump of our database of over 40,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

• • UpdraftPlus <= 1.26.11 – UDRPC key compromise

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Total Vulnerabilities by CVSS Severity Last Week

Total Vulnerabilities by CWE Type Last Week

Researchers That Contributed to WordPress Security Last Week

Researcher Name	Number of Vulnerabilities
Karthik Ramakrishnan	22
Naoki Kawahigashi	20
João Pedro S Alcântara	11
Ananda Dhakal	10
Jakub Herman	9
Peter Tang	7
Deva Parekh	6
Intrudify	5
RIA Labs	5
Muni Nitish Kumar Yaddala	5
Ryan Fabella	5
yzx001	5
Tarcísio Luchesi	4
beopseong.kim	4
Enrico Marcolini	4
Claudio Marchesini	4
Dottor Marc	4
leon figueira	3
Usama Arshad	3
dcs	3
Ayukiab	3
Jacek Sowiński	3
HAIMIN	3
Seongwon Lee	3
V1T	3
Huseyn Huseynov	2
Huseyn	2
Erwan LR	2
Jacek Sowiński (dzaku)	2
Austin Ginder	2
Mor Golan	2
AndrewN	2
Pablo González Pérez	2
Francisco José Ramírez Vicente	2
Iñigo Sánchez Enciso	2
Ikram-4	2
Sanjeev Kumar	2
fcc	2
vuxvinh	2
Ravenska Dhigna Manggala	2
John Ryan Albon	2
Mohammed Abd Alrahman	2
Aarush Gaur	2
Mahammad Mammadov	2
Charles Vosburgh	2
Raphael P. Cigana	2
johska	2
Het Kalariya	2
ssophiz	2
Oly Hossen	2
Tran Nguyen Bao Khanh	2
emiliano carrizo	1
Safraz Sears @ Greyield Labs	1
Trần Văn Hoàng	1
Nixxies	1
Elieve	1
Yuto Hyakumoto	1
Nguyễn Đức Hòa	1
pb>sec	1
Phat RiO	1
Andrei	1
Arman Kumar	1
furkan.araspro	1
Nicat Sultanov	1
Mutantgun	1
Dmitrii Ignatyev	1
an7ln	1
MD Mahmidul Hasan	1
Dthangws	1
Ratchanon Chamnankit	1
mroccon	1
Calum Gannon	1
Wes Ring	1
Ahmed Hashim Ismael	1
Shirshak	1
Matthew Lapinski	1
buiih	1
Duy Tran	1
Kartik sharma	1
Wordfence PRISM	1
HarshG	1
Alex Thomas	1
Wordfence Argus	1
Md Mehedi Hasan	1
Hamza Tlili	1
Pedro Pinho	1
Rafie Muhammad	1
Filip Kowalski	1
SVO	1
JunHee CHO	1
daroo	1
Alpaslan Fatih Sözer	1
Meher Sudhakar Abbireddi	1
jydae	1
Suhayb Ahmed	1
changsheng	1
Zahid Abbasi	1
whp-wessel	1
Civitasmass	1
minaruzzaman shovon	1
Sanjar Tulkinov	1
Andy Urlep	1
Anatoly Gorbounov	1
Hariom Singh	1
Taegyeong Yun	1
Kwak Do Hun	1
Szymon Szymkowiak	1
Daniel Dhaniswara	1
Abdulsamad Yusuf (0xVenus)	1
Vincent Suen	1
Haemanth VJ	1
Mokksh Parekh	1
Hanif Naufal Rahman	1
Sarvar Eshboyev	1
cyberkareem	1
Noverdi Anugrah Ramadhan	1
0xBassia	1
Asim Alshaya	1
Ihsan Saddan	1
nh4tvd	1
MYUNGYONG LEE	1
souparna majumder	1
Md. Minaruzzaman Shovon	1
Revanth Hari Narayana Matte	1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

WordPress Themes with Reported Vulnerabilities Last Week

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Advanced Custom Fields: Extended <= 0.9.2.7 – Unauthenticated Remote Code Execution

9.8

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-94267

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

Advanced Custom Fields: Extended [acf-extended]

Advanced Custom Fields: Extended PRO [acf-extended-pro]

Researcher

Jakub Herman

More Details >

Advanced Custom Fields: Extended 0.9.2.7 – Unauthenticated Privilege Escalation via Account Takeover

9.8

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-94268

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

Advanced Custom Fields: Extended [acf-extended]

Advanced Custom Fields: Extended PRO [acf-extended-pro]

Researcher

Jakub Herman

More Details >

Prime Mover <= 2.2.1 – Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace

9.8

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-115806

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Prime Mover – Backup and Migration [prime-mover]

Researcher

Civitasmass

More Details >

WP Mailster <= 1.9.1.0 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-111832

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

WP Mailster [wp-mailster]

Researcher

Peter Tang

More Details >

YOOtheme Pro 5.0.0 – 5.0.52 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
9.8 (Critical)

CVE-ID

CVE-2026-102785

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

YOOtheme Pro [yootheme]

Researcher(s): Unknown

More Details >

Advanced Custom Fields: Extended <= 0.9.2.7 – Unauthenticated Arbitrary File Deletion

9.1

CVSS Rating
9.1 (Critical)

CVE-ID

CVE-2026-112311

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

Advanced Custom Fields: Extended [acf-extended]

Researcher

furkan.araspro

More Details >

weForms – Easy Drag & Drop Contact Form Builder For WordPress <= 1.6.28 – Unauthenticated Arbitrary File Deletion

9.1

CVSS Rating
9.1 (Critical)

CVE-ID

CVE-2026-111833

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

weForms – Easy Drag & Drop Contact Form Builder For WordPress [weforms]

Researcher

Peter Tang

More Details >

aBlocks <= 2.17.0 – Authenticated (Contributor+) Privilege Escalation to ‘roleSlug’ Block Attribute

8.8

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-110018

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder [ablocks]

Researcher

Wordfence PRISM

More Details >

Classified Listing – AI-Powered Classified ads & Business Directory <= 6.1.5 – Authenticated (Subscriber+) Arbitrary PHP Code Execution

8.8

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-111828

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Classified Listing – AI-Powered Classified ads & Business Directory [classified-listing]

Researcher

changsheng

More Details >

CM HIPAA Forms <= 3.3.1 – Authenticated (hipaa_forms+) Privilege Escalation

8.8

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-109927

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

HIPAA Forms [codemonkeys-hipaa-forms]

Researchers

Enrico Marcolini

Claudio Marchesini

Dottor Marc

More Details >

Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 – Unauthenticated PHP Object Injection

8.8

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-82814

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator]

Duplicator Pro [duplicator-pro]

Researchers

Alex Thomas

Wordfence Argus

More Details >

Mang Board <= 2.4.4 – Authenticated (Subscriber+) Arbitrary File Upload

8.8

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-111834

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Mang Board [mangboard]

Researcher

Nixxies

More Details >

Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1068 – Authenticated (Contributor+) Remote Code Execution

8.8

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-111851

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]

Researcher

Intrudify

More Details >

Uncanny Toolkit for LearnDash < 3.8.2 – Cross-Site Request Forgery

8.8

CVSS Rating
8.8 (High)

CVE-ID

CVE-2026-107127

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Uncanny Toolkit for LearnDash [uncanny-learndash-toolkit]

Researcher

Ryan Fabella

More Details >

Academist Core <= 1.4.1 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-112820

Patch Status

Unpatched

Published
Oct 20, 2026

Affected Software

Academist Core [academist-core]

Researcher

Tran Nguyen Bao Khanh

More Details >

Hallelujah <= 1.1.1 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-112853

Patch Status

Unpatched

Published
Oct 21, 2026

Affected Software

Hallelujah | Religion & Church Charity WordPress Theme [hallelujah]

Researcher

João Pedro S Alcântara

More Details >

Helion | Personal Portfolio & Agency WordPress Theme <= 1.1.12 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-112852

Patch Status

Unpatched

Published
Oct 21, 2026

Affected Software

Helion | Personal Portfolio & Agency WordPress Theme [helion]

Researcher

João Pedro S Alcântara

More Details >

Holistic Center <= 1.2.6 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-112854

Patch Status

Unpatched

Published
Oct 21, 2026

Affected Software

Holistic Center | Wellness & Spa Salon PSD Template [holistic-center]

Researcher

João Pedro S Alcântara

More Details >

Hostme v2 – Responsive WordPress Theme <= 7.0 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-112848

Patch Status

Unpatched

Published
Oct 21, 2026

Affected Software

Hostme v2 – Responsive WordPress Theme [hostmev2]

Researcher

João Pedro S Alcântara

More Details >

HotLock | Locksmith & Security Systems WordPress Theme + RTL <= 1.3.9 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-112851

Patch Status

Unpatched

Published
Oct 21, 2026

Affected Software

HotLock | Locksmith & Security Systems WordPress Theme + RTL [hotlock]

Researcher

João Pedro S Alcântara

More Details >

Little Birdies | Multipurpose Children PSD Template <= 1.3.16 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-112859

Patch Status

Unpatched

Published
Oct 21, 2026

Affected Software

Little Birdies | Multipurpose Children PSD Template [little-birdies]

Researcher

João Pedro S Alcântara

More Details >

Newsletters <= 4.18.1 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-94075

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Newsletters [newsletters-lite]

Researcher

Ananda Dhakal

More Details >

Participants Database <= 2.7.8.5 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-112862

Patch Status

Unpatched

Published
Oct 21, 2026

Affected Software

Participants Database [participants-database]

Researcher

Tarcísio Luchesi

More Details >

Paytium: Mollie payment forms & donations <= 5.0.5 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-114196

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Paytium: Mollie payment forms & donations [paytium]

Researcher

Tarcísio Luchesi

More Details >

Redy <= 1.3.5 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-112855

Patch Status

Unpatched

Published
Oct 21, 2026

Affected Software

redy [redy]

Researcher

João Pedro S Alcântara

More Details >

Reprizo – Jewelry & Watch Store Shopify Theme <= 1.0.8 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-112857

Patch Status

Unpatched

Published
Oct 21, 2026

Affected Software

Reprizo – Jewelry & Watch Store Shopify Theme [reprizo]

Researcher

João Pedro S Alcântara

More Details >

Rhodos – Business Portfolio Elementor Blocks & Template Kit <= 1.3.3 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-112858

Patch Status

Unpatched

Published
Oct 21, 2026

Affected Software

Rhodos – Business Portfolio Elementor Blocks & Template Kit [rhodos]

Researcher

João Pedro S Alcântara

More Details >

Rootblox – Header & Footer Builder for Full Site Editing (FSE) <= 1.0.6 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-112832

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

Rootblox – Header & Footer Builder for Full Site Editing (FSE) [rootblox]

Researcher

Peter Tang

More Details >

Save Life | Non-Profit, Charity & Donations WordPress Theme <= 1.2.14 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-112846

Patch Status

Unpatched

Published
Oct 21, 2026

Affected Software

Save Life | Non-Profit, Charity & Donations WordPress Theme [save-life]

Researcher

johska

More Details >

Vagabonds – Travel Blog Elementor Template Kit <= 1.3.10 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-112856

Patch Status

Unpatched

Published
Oct 21, 2026

Affected Software

Vagabonds – Travel Blog Elementor Template Kit [vagabonds]

Researcher

João Pedro S Alcântara

More Details >

Your Dress <= 1.4.1 – Unauthenticated Local File Inclusion

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-112850

Patch Status

Unpatched

Published
Oct 21, 2026

Affected Software

Your Dress | Dress Rental & Clothing Store WordPress Theme + Shop [your-dress]

Researcher

Tran Nguyen Bao Khanh

More Details >

ZenSoul <= 1.13 – Unauthenticated PHP Object Injection

8.1

CVSS Rating
8.1 (High)

CVE-ID

CVE-2026-112847

Patch Status

Unpatched

Published
Oct 21, 2026

Affected Software

ZenSoul – Spa Salon & Wellness WordPress Theme + Shop & AI [zensoul]

Researcher

johska

More Details >

Ajax Search Lite – Live Search & Filter <= 4.14.6 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-111852

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Ajax Search Lite – Live Search & Filter [ajax-search-lite]

Researcher

Jacek Sowiński (dzaku)

More Details >

Booking for Appointments and Events Calendar – Amelia <= 2.4.11 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-112327

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

Booking for Appointments and Events Calendar – Amelia [ameliabooking]

Researcher

SVO

More Details >

Click n Chat <= 1.1.2 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-92997

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Click n Chat (Chat Widget Integration) [click-n-chat]

Researcher

Ryan Fabella

More Details >

Click n Chat 1.0.4 – 1.1.2 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-92998

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Click n Chat (Chat Widget Integration) [click-n-chat]

Researcher

Erwan LR

More Details >

EventON – Subscriber <= 1.4.5 – Unauthenticated SQL Injection via ’email’ Parameter

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-93300

Patch Status

Unpatched

Published
Oct 19, 2026

Affected Software

EventON – Subscriber [eventon-subscriber]

Researcher

Austin Ginder

More Details >

Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder < 7.0 – Unauthenticated Denial of Service

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-85642

Patch Status

Patched

Published
Oct 21, 2026

Affected Software

Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder [formidable]

Researcher

Naoki Kawahigashi

More Details >

GS Pinterest Portfolio – Pins Grid, Masonry, User Profile, Popup & Board Widgets <= 1.9.2 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-110370

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

GS Pinterest Portfolio – Pins Grid, Masonry, User Profile, Popup & Board Widgets [gs-pinterest-portfolio]

Researcher

Ananda Dhakal

More Details >

Newsletters <= 4.18.1 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-111402

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Newsletters [newsletters-lite]

Researcher

Noverdi Anugrah Ramadhan

More Details >

Participants Database <= 2.7.8.5 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-112860

Patch Status

Unpatched

Published
Oct 21, 2026

Affected Software

Participants Database [participants-database]

Researcher

Tarcísio Luchesi

More Details >

Product Filter for WooCommerce by WBW <= 3.4.6 – Unauthenticated SQL Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-112866

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Product Filter for WooCommerce by WBW [woo-product-filter]

Researcher

Yuto Hyakumoto

More Details >

Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP < 1.5.7 – Authentication Bypass

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-111958

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP [royal-mcp]

Researcher

Raphael P. Cigana

More Details >

Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More <= 2.8.2 – Authenticated (Contributor+) PHP Object Injection

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-110369

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More [gs-team-members]

Researcher

Ananda Dhakal

More Details >

WP Mailster <= 1.9.1.0 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
7.5 (High)

CVE-ID

CVE-2026-111829

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

WP Mailster [wp-mailster]

Researcher

V1T

More Details >

Advanced Custom Fields: Extended 0.9.2.7 – Unauthenticated Arbitrary Non-Admin Account Takeover

7.3

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-94262

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

Advanced Custom Fields: Extended [acf-extended]

Advanced Custom Fields: Extended PRO [acf-extended-pro]

Researcher

Karthik Ramakrishnan

More Details >

Datawiza Proxy Auth <= 1.1.0 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-115214

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

Datawiza Proxy Auth Plugin – SSO [reverse-proxy-auth-widget]

Researcher

Naoki Kawahigashi

More Details >

User Manager 2.9.21 – 2.9.25 – Unauthenticated Privilege Escalation

7.3

CVSS Rating
7.3 (High)

CVE-ID

CVE-2026-110523

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager]

Researcher

Charles Vosburgh

More Details >

Advanced Custom Fields: Extended <= 0.9.2.7 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-112313

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

Advanced Custom Fields: Extended [acf-extended]

Researcher

Asim Alshaya

More Details >

Anti-Spam by CleanTalk <= 6.89.1 – Unauthenticated Stored Cross-Site Scripting via ‘user_email’ Registration Parameter

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-109198

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Anti-Spam, Spam FireWall by CleanTalk [cleantalk-spam-protect]

Researcher

daroo

More Details >

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots <= 3.1.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-114179

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots [bp-better-messages]

Researcher

John Ryan Albon

More Details >

Contact Form Email <= 1.3.68 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-112379

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

Contact Form Email [contact-form-to-email]

Researcher

AndrewN

More Details >

Depicter — Popup & Slider Builder 4.0.5 – 4.8.1 – Authenticated (Editor+) Arbitrary File Upload

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-113472

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

Depicter — Popup & Slider Builder [depicter]

Researcher

Karthik Ramakrishnan

More Details >

Duplicator <= 1.5.17 – Authenticated (Multisite Subsite Admin+) Arbitrary Code Execution

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-115251

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More [duplicator]

Researcher

Charles Vosburgh

More Details >

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.26 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-112844

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce [wp-event-solution]

Researcher

Dthangws

More Details >

GeoDirectory <= 2.8.193 – Authenticated (Administrator+) Remote Code Execution

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-113673

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]

Researcher

Karthik Ramakrishnan

More Details >

Hostme v2 – Responsive WordPress Theme <= 7.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-112849

Patch Status

Unpatched

Published
Oct 21, 2026

Affected Software

Hostme v2 – Responsive WordPress Theme [hostmev2]

Researcher

João Pedro S Alcântara

More Details >

Jane Menu <= 1.5.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-85683

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Jane Menu [jane-menu]

Researcher

Naoki Kawahigashi

More Details >

KALLYAS – Creative eCommerce Multi-Purpose WordPress Theme <= 4.25.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-112863

Patch Status

Unpatched

Published
Oct 21, 2026

Affected Software

kallyas [kallyas]

Researcher

Rafie Muhammad

More Details >

LiteSpeed Cache < 7.9.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-113500

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

LiteSpeed Cache [litespeed-cache]

Researcher

Jakub Herman

More Details >

LiteSpeed Cache < 7.9.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-113499

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

LiteSpeed Cache [litespeed-cache]

Researcher

Jakub Herman

More Details >

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-110899

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms]

Researcher

Kwak Do Hun

More Details >

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE < 3.2.8 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-109936

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE [otter-blocks]

Researcher

Jakub Herman

More Details >

PixelYourSite (Pro + Free) – Your smart PIXEL (TAG) Manager (plugin) < 11.4.3 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-109987

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

PixelYourSite – Your smart PIXEL (TAG) & API Manager [pixelyoursite]

PixelYourSite Pro – Your smart PIXEL (TAG) Manager [pixelyoursite-pro]

Researcher

Jakub Herman

More Details >

QA Assistants – Driven by data <= 5.3.0.1 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-114697

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

QA Assistants – Driven by data [qa-heatmap-analytics]

Researcher

leon figueira

More Details >

Redirection for Contact Form 7 2.2.7 – 3.2.11 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-111574

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Redirection for Contact Form 7 [wpcf7-redirect]

Researcher

Dmitrii Ignatyev

More Details >

Strong Testimonials <= 3.3.12 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-107435

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Strong Testimonials [strong-testimonials]

Researcher

jydae

More Details >

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-112221

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart]

Researcher

Deva Parekh

More Details >

VikRentCar Car Rental Management System <= 1.4.8 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-112835

Patch Status

Patched

Published
Oct 21, 2026

Affected Software

VikRentCar Car Rental Management System [vikrentcar]

Researcher

Ayukiab

More Details >

VikRentCar Car Rental Management System <= 1.4.8 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-112838

Patch Status

Patched

Published
Oct 21, 2026

Affected Software

VikRentCar Car Rental Management System [vikrentcar]

Researcher

leon figueira

More Details >

VOD Infomaniak <= 1.5.14 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-114695

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

VOD Infomaniak [vod-infomaniak]

Researcher

Peter Tang

More Details >

W3 Total Cache <= 2.10.7 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-114178

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

W3 Total Cache [w3-total-cache]

Researcher

fcc

More Details >

WebP Express <= 0.25.15 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-97328

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

WebP Express [webp-express]

Researcher

Jakub Herman

More Details >

Weglot <= 6.4.2 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-88784

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Translate WordPress with Weglot 2.0 – Multilingual AI Translation [weglot]

Researcher

Jakub Herman

More Details >

WP Mailster <= 1.9.1.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
7.2 (High)

CVE-ID

CVE-2026-111830

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

WP Mailster [wp-mailster]

Researcher

V1T

More Details >

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 – Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block ‘Assigned Role’ Attribute

7.1

CVSS Rating
7.1 (High)

CVE-ID

CVE-2026-115807

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]

Researcher

pb>sec

More Details >

Relevanssi – A Better Search <= 4.28.4 – Authenticated (Editor+) PHP Object Injection

6.6

CVSS Rating
6.6 (Medium)

CVE-ID

CVE-2026-114704

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Relevanssi – A Better Search [relevanssi]

Researcher

Ananda Dhakal

More Details >

Advanced Custom Fields: Extended 0.9.2.4 – 0.9.2.7 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-94263

Patch Status

Patched

Published
Oct 21, 2026

Affected Software

Advanced Custom Fields: Extended [acf-extended]

Researcher

Karthik Ramakrishnan

More Details >

GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI <= 8.0.7 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-112837

Patch Status

Patched

Published
Oct 21, 2026

Affected Software

GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI [gamipress]

Researcher

leon figueira

More Details >

GeoDirectory <= 2.8.193 – Authenticated (Subscriber+) Arbitrary Media File Read

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-113491

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]

Researcher

vuxvinh

More Details >

GiveWP <= 4.19.0.0 – Authenticated (Give Manager+) Path Traversal

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-111978

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

Karthik Ramakrishnan

More Details >

Modern Events Calendar < 7.37.0 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-102499

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Modern Events Calendar [modern-events-calendar]

Modern Events Calendar Lite [modern-events-calendar-lite]

Researcher

Wes Ring

More Details >

Modern Events Calendar < 7.37.0 – Authenticated (Subscriber+) SQL Injection via mec_fes_csv_export

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-96534

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Modern Events Calendar [modern-events-calendar]

Modern Events Calendar Lite [modern-events-calendar-lite]

Researcher

Sanjar Tulkinov

More Details >

Swift Performance Lite <= 2.3.7.3 – Authenticated (Author+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-110651

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Swift Performance Lite [swift-performance-lite]

Researcher

Naoki Kawahigashi

More Details >

Ultimate Review <= 2.4.4 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-103234

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

WP Ultimate Review [wp-ultimate-review]

Researcher

Erwan LR

More Details >

Workreap Core < 3.4.4 – Authenticated (Subscriber+) SQL Injection

6.5

CVSS Rating
6.5 (Medium)

CVE-ID

CVE-2026-112822

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

Workreap Core [workreap_core]

Researcher

Phat RiO

More Details >

Addon Elements for Elementor (formerly Elementor Addon Elements) <= 1.14.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-114184

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Addon Elements for Elementor (formerly Elementor Addon Elements) [addon-elements-for-elementor-page-builder]

Researcher

Intrudify

More Details >

Advanced Custom Fields: Extended 0.8.9.4 – 0.9.2.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-94264

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

Advanced Custom Fields: Extended [acf-extended]

Advanced Custom Fields: Extended PRO [acf-extended-pro]

Researcher

Karthik Ramakrishnan

More Details >

Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution < 6.0.0 – Authenticated (Custom Role+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-79627

Patch Status

Patched

Published
Oct 21, 2026

Affected Software

Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution [file-manager-advanced]

Researcher

Karthik Ramakrishnan

More Details >

All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos <= 4.9.7 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-114693

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos [all-in-one-video-gallery]

Researcher

beopseong.kim

More Details >

Brizy – Page Builder 2.8.23 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-111844

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

Brizy – Page Builder [brizy]

Researcher

Ayukiab

More Details >

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 34.0.1 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-111837

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]

Researcher

beopseong.kim

More Details >

DiviGear Carousel <= 5.2.0 – Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-93878

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

DiviGear Carousel [dg-divi-carousel]

Researcher

Austin Ginder

More Details >

E2Pdf – Export Pdf Tool for WordPress <= 1.32.57 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-111410

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

E2Pdf – Export Pdf Tool for WordPress [e2pdf]

Researcher

V1T

More Details >

Elementor <= 4.3.4 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-81812

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Elementor Website Builder – more than just a page builder [elementor]

Researcher

Nguyễn Đức Hòa

More Details >

Elementor <= 4.3.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-81813

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Elementor Website Builder – more than just a page builder [elementor]

Researcher

Mohammed Abd Alrahman

More Details >

Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.8.7 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-110510

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]

Researcher

Karthik Ramakrishnan

More Details >

Extensions for Leaflet Map <= 6.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-114703

Patch Status

Unpatched

Published
Oct 22, 2026

Affected Software

Extensions for Leaflet Map [extensions-leaflet-map]

Researcher

Ananda Dhakal

More Details >

Falang multilanguage for WordPress <= 1.4.5 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-105262

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Falang multilanguage for WordPress [falang]

Researcher

Seongwon Lee

More Details >

GeoDirectory <= 2.8.193 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-113493

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]

Researcher

Jacek Sowiński

More Details >

GiveWP <= 4.19.0.0 – Authenticated (Give Worker+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-111979

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

Karthik Ramakrishnan

More Details >

Interactive Content – H5P <= 1.17.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-112867

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Interactive Content – H5P [h5p]

Researcher

Intrudify

More Details >

JetElements <= 2.9.2.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-111414

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

JetElements [jet-elements]

Researcher

nh4tvd

More Details >

Job Openings <= 4.1.0 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-107790

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

HireZoot – Job Listings, Career Page & Recruitment Tool [wp-job-openings]

Researcher

Md Mehedi Hasan

More Details >

Link Library <= 7.9.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-78392

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

Link Library [link-library]

Researcher

Karthik Ramakrishnan

More Details >

ND Shortcodes <= 7.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-114702

Patch Status

Unpatched

Published
Oct 22, 2026

Affected Software

ND Shortcodes [nd-shortcodes]

Researcher

Ananda Dhakal

More Details >

Off-Canvas Sidebars & Menus (Slidebars) <= 0.5.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-112845

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Off-Canvas Sidebars & Menus (Slidebars) [off-canvas-sidebars]

Researcher

Ihsan Saddan

More Details >

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE < 3.2.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-109933

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE [otter-blocks]

Researcher

Karthik Ramakrishnan

More Details >

Photo Engine <= 6.5.7 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-111971

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

Photo Engine (Media Organizer & Lightroom) [wplr-sync]

Researcher

Mahammad Mammadov

More Details >

Pixel Tag Manager for WooCommerce <= 2.2.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-105199

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Pixel Tag Manager for WooCommerce – Google Analytics 4, Google Ads, and More Pixels [pixel-manager-for-woocommerce]

Researcher

Suhayb Ahmed

More Details >

Restaurant Menu – Food Ordering System – Table Reservation <= 2.4.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-114700

Patch Status

Unpatched

Published
Oct 22, 2026

Affected Software

Restaurant Menu – Food Ordering System – Table Reservation [menu-ordering-reservations]

Researcher

Ananda Dhakal

More Details >

Rootblox – Header & Footer Builder for Full Site Editing (FSE) <= 1.0.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-111843

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

Rootblox – Header & Footer Builder for Full Site Editing (FSE) [rootblox]

Researcher

Peter Tang

More Details >

Seriously Simple Podcasting <= 3.17.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-112833

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

Seriously Simple Podcasting [seriously-simple-podcasting]

Researcher

Deva Parekh

More Details >

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-112840

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart]

Researcher

Deva Parekh

More Details >

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-111966

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]

Researcher

Jacek Sowiński

More Details >

VR 8.5.49 – 9.0.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-114429

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress [wpvr]

Researcher

Huseyn Huseynov

More Details >

Waitlist Woocommerce ( Back in stock notifier ) <= 2.9.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-114701

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Waitlist Woocommerce ( Back in stock notifier ) [waitlist-woocommerce]

Researcher

Ananda Dhakal

More Details >

YITH WooCommerce Wishlist <= 4.18.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
6.4 (Medium)

CVE-ID

CVE-2026-112199

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

YITH WooCommerce Wishlist [yith-woocommerce-wishlist]

Researcher

Intrudify

More Details >

HIPAA Forms < 3.3.2 – Authenticated (Custom Role+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)

CVE-ID

CVE-2026-109927

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

HIPAA Forms [codemonkeys-hipaa-forms]

Researchers

Enrico Marcolini

Claudio Marchesini

Dottor Marc

More Details >

Qi Addons For Elementor <= 1.11.1 – Authenticated (Contributor+) Arbitrary HTML Injection

6.3

CVSS Rating
6.3 (Medium)

CVE-ID

CVE-2026-115183

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

Qi Addons For Elementor [qi-addons-for-elementor]

Researcher

Karthik Ramakrishnan

More Details >

Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website < 3.3.3 – Authenticated (Custom Role+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)

CVE-ID

CVE-2026-107506

Patch Status

Patched

Published
Oct 21, 2026

Affected Software

Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website [simple-banner]

Researcher

Jakub Herman

More Details >

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.4 – Authenticated (Author+) Privilege Escalation

6.3

CVSS Rating
6.3 (Medium)

CVE-ID

CVE-2026-112242

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]

Researcher

Calum Gannon

More Details >

Ad Inserter – Ad Manager & AdSense Ads <= 2.8.18 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-114194

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Ad Inserter – Ad Manager & AdSense Ads [ad-inserter]

Researcher

yzx001

More Details >

Booking System <= 2.1.0.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-109147

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

WP Booking System – Booking Calendar [wp-booking-system]

Researcher

Zahid Abbasi

More Details >

Download Monitor <= 5.3.3 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-112207

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Download Monitor [download-monitor]

Researcher

Karthik Ramakrishnan

More Details >

Eventer – WordPress Event & Booking Manager Plugin <= 0.1.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-27394

Patch Status

Unpatched

Published
Oct 20, 2026

Affected Software

Eventer [eventer]

Researcher

Abdulsamad Yusuf (0xVenus)

More Details >

Events Manager – Calendar, Bookings, Tickets, Appointments and more! <= 7.4.8 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-114694

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Events Manager – Calendar, Bookings, Tickets, Appointments and more! [events-manager]

Researcher

AndrewN

More Details >

Geo Mashup <= 1.13.22 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-111848

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Geo Mashup [geo-mashup]

Researcher

beopseong.kim

More Details >

Live Summary for Gravity Forms <= 1.2.10 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-110884

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Live Summary for Gravity Forms [live-summary-for-gravity-forms]

Researcher

John Ryan Albon

More Details >

Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.5.14 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-111840

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Paid Videochat Turnkey Site – HTML5 PPV Live Webcams [ppv-live-webcams]

Researcher

Safraz Sears @ Greyield Labs

More Details >

Profile Builder <= 4.0.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-111948

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]

Researcher

0xBassia

More Details >

ThemeHunk Customizer <= 2.8.7 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-111838

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

ThemeHunk Customizer [themehunk-customizer]

Researcher

Elieve

More Details >

We’re Open! <= 2.6 – Reflected Cross-Site Scripting

6.1

CVSS Rating
6.1 (Medium)

CVE-ID

CVE-2026-112869

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

We’re Open! [opening-hours]

Researcher

Mor Golan

More Details >

Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms < 1.26.15 – Unauthenticated HTML Injection

5.8

CVSS Rating
5.8 (Medium)

CVE-ID

CVE-2026-14556

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms [happyforms]

Researcher

minaruzzaman shovon

More Details >

Advanced Custom Fields: Extended <= 0.9.2.7 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-112312

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

Advanced Custom Fields: Extended [acf-extended]

Researcher

Peter Tang

More Details >

asVereinbase <= 1.1.7 – Two-Factor Authentication Bypass

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-110956

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

asVereinbase – Club & Member Management for WP [asvereinbase]

Researcher(s): Unknown

More Details >

BjornTech Swish for WooCommerce <= 3.7.8 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-111835

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

BjornTech Swish for WooCommerce [woo-swish-e-commerce]

Researcher

Alpaslan Fatih Sözer

More Details >

Booking Package < 1.7.31 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-105996

Patch Status

Patched

Published
Oct 21, 2026

Affected Software

Booking Package [booking-package]

Researcher

emiliano carrizo

More Details >

Booking Package <= 1.7.30 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-105998

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Booking Package [booking-package]

Researcher

Md. Minaruzzaman Shovon

More Details >

Booking Package <= 1.7.30 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-105999

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Booking Package [booking-package]

Researcher

Revanth Hari Narayana Matte

More Details >

Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.30 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-112829

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

Booktics – Appointment Booking Calendar for Service Businesses [booktics]

Researcher

Matthew Lapinski

More Details >

Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP <= 7.3.7 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-111839

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP [videowhisper-live-streaming-integration]

Researcher

Muni Nitish Kumar Yaddala

More Details >

Bus Ticket Booking with Seat Reservation <= 5.9.7 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-112824

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

Bus Ticket Booking with Seat Reservation [bus-ticket-booking-with-seat-reservation]

Researcher

Muni Nitish Kumar Yaddala

More Details >

Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails < 2.2.0 – Unauthenticated Abandoned Cart Takeover

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-96901

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails [woo-cart-abandonment-recovery]

Researcher

Usama Arshad

More Details >

CCAvenue Payment Gateway for WooCommerce <= 3.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-103298

Patch Status

Unpatched

Published
Oct 23, 2026

Affected Software

CCAvenue Payment Gateway for WooCommerce [ccavanue-woocommerce-payment-getway]

Researcher

Naoki Kawahigashi

More Details >

Chikkili Google Pay for WooCommerce <= 1.0.6 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-94295

Patch Status

Unpatched

Published
Oct 22, 2026

Affected Software

Chikkili- Google Pay India for Woocommerce [chikkili-google-pay-for-woocommerce]

Researcher

Pedro Pinho

More Details >

Click n Chat 1.0.4 – 1.1.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-92999

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Click n Chat (Chat Widget Integration) [click-n-chat]

Researcher

Mokksh Parekh

More Details >

CMP – Coming Soon & Maintenance Plugin by NiteoThemes 4.1.19 – 4.1.20 – Missing Authorization to Unauthenticated Maintenance Mode Bypass

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-101138

Patch Status

Patched

Published
Oct 21, 2026

Affected Software

CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance]

Researcher

Sanjeev Kumar

More Details >

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe < 34.0.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-107447

Patch Status

Patched

Published
Oct 21, 2026

Affected Software

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe [contest-gallery]

Researcher

Nicat Sultanov

More Details >

Ettrick Escape Room Booking <= 1.3.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-105992

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Escape Room Booking Pro [ettrick-escape-room-booking]

Researcher

Ryan Fabella

More Details >

Eurobank WooCommerce Payment Gateway <= 2.1.1 – Unauthenticated Order Payment Forgery

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-103300

Patch Status

Unpatched

Published
Oct 23, 2026

Affected Software

Eurobank WooCommerce Payment Gateway [woo-payment-gateway-for-eurobank]

Researcher

Naoki Kawahigashi

More Details >

Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar <= 5.7.8 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-114192

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar [mage-eventpress]

Researcher

dcs

More Details >

Falcon – Cache, Performance, Security, Cleanup, and Tweaks <= 2.12.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-112826

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Falcon – Cache, Performance, Security, Cleanup, and Tweaks [falcon]

Researcher

HAIMIN

More Details >

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.15 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-111831

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder [fluentform]

Researcher

fcc

More Details >

FluentCart <= 2.1.0 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-100142

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler [fluent-cart]

Researcher

Mutantgun

More Details >

Front End Users <= 3.2.35 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-87835

Patch Status

Unpatched

Published
Oct 21, 2026

Affected Software

Front End Users [front-end-only-users]

Researcher

Ahmed Hashim Ismael

More Details >

GeoDirectory <= 2.8.193 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-113674

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]

Researcher

Vincent Suen

More Details >

GeoDirectory <= 2.8.193 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-113490

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]

Researcher

Karthik Ramakrishnan

More Details >

GeoDirectory <= 2.8.193 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-113492

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]

Researcher

Jacek Sowiński

More Details >

GiveWP <= 4.19.0.0 – Unauthenticated Donation Amount Restriction Bypass

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-111974

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

Shirshak

More Details >

GiveWP <= 4.19.0.0 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-111976

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

vuxvinh

More Details >

iKhokha Payment Gateway <= 3.0.3 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-103306

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

Online Payments with iK Pay Gateway [ikhokha-payment-gateway]

Researcher

Naoki Kawahigashi

More Details >

Infility Global <= 2.16.24 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-109931

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

Infility Global [infility-global]

Researchers

Enrico Marcolini

Claudio Marchesini

Dottor Marc

More Details >

Kliken: Ads + Pixel for Meta <= 1.2.2 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-111596

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Kliken: Ads + Pixel for Meta [kliken-ads-pixel-for-meta]

Researcher

Huseyn

More Details >

Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more <= 9.6.3.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-112821

Patch Status

Patched

Published
Oct 21, 2026

Affected Software

Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more [knit-pay]

Researcher

Ravenska Dhigna Manggala

More Details >

LatePoint <= 5.7.4 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-105256

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researcher

Filip Kowalski

More Details >

LiteSpeed Cache <= 7.9 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-114190

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

LiteSpeed Cache [litespeed-cache]

Researcher

Ananda Dhakal

More Details >

Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.2.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-112218

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin [majestic-support]

Researcher

HAIMIN

More Details >

MB Custom Post Types & Custom Taxonomies 2.0.2 – 2.12.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-110010

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

MB Custom Post Types & Custom Taxonomies [mb-custom-post-type]

Researcher

RIA Labs

More Details >

MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-114180

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor [metform]

Researcher

Andrei

More Details >

Mintpay <= 2.2.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-103381

Patch Status

Unpatched

Published
Oct 23, 2026

Affected Software

Mintpay for WooCommerce [mintpay]

Researcher

Naoki Kawahigashi

More Details >

nexi Alpha Bank for WooCommerce <= 2.2.0 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-103299

Patch Status

Unpatched

Published
Oct 23, 2026

Affected Software

Payment Gateway – nexi Alpha Bank for WooCommerce [woo-alpha-bank-payment-gateway]

Researcher

Naoki Kawahigashi

More Details >

OPay Payment Gateway for WooCommerce <= 2.5.5 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-103319

Patch Status

Unpatched

Published
Oct 23, 2026

Affected Software

OPay Payment Gateway for WooCommerce [opay-payment-gateway-for-woocommerce]

Researcher

Naoki Kawahigashi

More Details >

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE < 3.2.8 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-109935

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE [otter-blocks]

Researcher

Karthik Ramakrishnan

More Details >

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE 3.1.1 – 3.2.7 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-109934

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE [otter-blocks]

Researcher

whp-wessel

More Details >

Page and Post Restriction <= 1.6.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-114696

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Page and Post Restriction [page-and-post-restriction]

Researcher

souparna majumder

More Details >

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 3.1.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-112842

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction [paid-member-subscriptions]

Researcher

Taegyeong Yun

More Details >

PayDunya WooCommerce Payment Gateway <= 1.1.6 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-103359

Patch Status

Unpatched

Published
Oct 24, 2026

Affected Software

PAYDUNYA WOOCOMMERCE PAR [paydunya-woocommerce-payment-gateway]

Researcher

Naoki Kawahigashi

More Details >

Payex Payment Gateway for WooCommerce <= 1.2.10 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-103332

Patch Status

Unpatched

Published
Oct 24, 2026

Affected Software

Payex Payment Gateway for Woocommerce [payex-payment-gateway-for-woocommerce]

Researcher

Naoki Kawahigashi

More Details >

Payment Gateway for Idram < 2.1.6 – Unauthenticated Arbitrary Order Status Manipulation

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-103302

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Payment Gateway for Idram [hk-idram-payment-gateway]

Researcher

Naoki Kawahigashi

More Details >

Payment Gateway for Telcell < 2.0.5 – Unauthenticated Payment Forgery

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-103301

Patch Status

Patched

Published
Oct 21, 2026

Affected Software

Payment Gateway for Telcell [payment-gateway-for-telcell]

Researcher

Naoki Kawahigashi

More Details >

Payment Integration Wompi <= 4.0.1 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-103312

Patch Status

Unpatched

Published
Oct 24, 2026

Affected Software

Payment Integration Wompi [payment-integration-wompi]

Researcher

Naoki Kawahigashi

More Details >

Popup Builder – Create highly converting, mobile friendly marketing popups. < 4.4.6 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-112230

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

Popup Builder – Create highly converting, mobile friendly marketing popups. [popup-builder]

Researcher

Raphael P. Cigana

More Details >

Seriously Simple Podcasting <= 3.17.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-112834

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

Seriously Simple Podcasting [seriously-simple-podcasting]

Researcher

Deva Parekh

More Details >

ShopMagic – email automation for WordPress <= 4.9.1 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-114195

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

ShopMagic – email automation for WordPress [shopmagic-for-woocommerce]

Researcher

dcs

More Details >

Simple Shopping Cart <= 5.3.2 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-104641

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Simple Shopping Cart [wordpress-simple-paypal-shopping-cart]

Researcher

Mohammed Abd Alrahman

More Details >

SmartyParcel <= 1.23.3 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-107789

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

SmartyParcel – DHL Express, GLS, InPost & Nova Post for WooCommerce [wc-ukr-shipping]

Researcher

Ryan Fabella

More Details >

Snap Finance <= 3.12.0 – Unauthenticated Payment Forgery

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-94273

Patch Status

Unpatched

Published
Oct 19, 2026

Affected Software

Snap Finance [snap-finance-checkout]

Researcher

Ryan Fabella

More Details >

Social Feed Gallery <= 5.0.13 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-114705

Patch Status

Unpatched

Published
Oct 22, 2026

Affected Software

Social Feed Gallery [insta-gallery]

Researcher

Intrudify

More Details >

Stripe Checkout <= 1.2.2.61 – Unauthenticated Payment Bypass

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-110285

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

WP Stripe Checkout [wp-stripe-checkout]

Researcher

Naoki Kawahigashi

More Details >

SUMIT Payment Gateway for WooCommerce < 4.0.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-111957

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

SUMIT Payment Gateway for WooCommerce [woo-payment-gateway-officeguy]

Researchers

Enrico Marcolini

Claudio Marchesini

Dottor Marc

More Details >

Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers <= 3.7.5 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-111842

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart]

Researcher

HarshG

More Details >

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-112241

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart]

Researcher

Deva Parekh

More Details >

SureCart <= 4.9.4 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-108073

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments [surecart]

Researcher

cyberkareem

More Details >

SureDash – Community, Courses & Member Dashboard <= 1.12.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-110894

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

SureDash – Community, Courses & Member Dashboard [suredash]

Researcher

yzx001

More Details >

SureDash – Community, Courses & Member Dashboard <= 1.12.2 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-110893

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

SureDash – Community, Courses & Member Dashboard [suredash]

Researcher

yzx001

More Details >

Synchrony Financing 1.0.5 – 1.1.1 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-100145

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Synchrony Financing [synchrony-payments]

Researcher

Naoki Kawahigashi

More Details >

TI WooCommerce Wishlist <= 2.12.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-15261

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

TI WooCommerce Wishlist [ti-woocommerce-wishlist]

Researcher

Duy Tran

More Details >

TiendaCrypto para WooCommerce 1.0.1 – 1.2.1 – Unauthenticated Order Payment Forgery

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-103325

Patch Status

Unpatched

Published
Oct 24, 2026

Affected Software

TiendaCrypto para WooCommerce [tienda-crypto-woo]

Researcher

Naoki Kawahigashi

More Details >

Travelly – Tour & Travel Booking Manager for WooCommerce <= 2.3.5 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-111849

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Travelly – Tour & Travel Booking Manager for WooCommerce [tour-booking-manager]

Researcher

HAIMIN

More Details >

UPI QR Code Payment Gateway for WooCommerce <= 1.6.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-114191

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

UPI QR Code Payment Gateway for WooCommerce [upi-qr-code-payment-for-woocommerce]

Researcher

ssophiz

More Details >

Wava Payment 0.3.1 – 0.3.9 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-87838

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Wava Payment Plugin [wava-payment]

Researchers

Pablo González Pérez

Francisco José Ramírez Vicente

Iñigo Sánchez Enciso

More Details >

Wava Payment 0.3.1 – 0.3.9 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-87837

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Wava Payment Plugin [wava-payment]

Researchers

Pablo González Pérez

Francisco José Ramírez Vicente

Iñigo Sánchez Enciso

More Details >

WholesaleX – All-in-One B2B Solution with Wholesale Pricing < 3.0.9 – Unauthenticated Account Activation Bypass

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-111955

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

WholesaleX – Wholesale Pricing & B2B Solution [wholesalex]

Researcher

Naoki Kawahigashi

More Details >

WholesaleX <= 3.0.8 – Unauthenticated Information Exposure

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-111956

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

WholesaleX – Wholesale Pricing & B2B Solution [wholesalex]

Researcher

Muni Nitish Kumar Yaddala

More Details >

WPMobile.App – Android and iOS App Builder <= 11.86 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-112359

Patch Status

Patched

Published
Oct 21, 2026

Affected Software

WPMobile.App – Android and iOS App Builder [wpappninja]

Researcher

Peter Tang

More Details >

YITH WooCommerce Product Bundles <= 2.29.0 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-111845

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

YITH WooCommerce Product Bundles [yith-woocommerce-product-bundles]

Researcher

Ratchanon Chamnankit

More Details >

ЮKassa для WooCommerce <= 2.17.3 – Missing Authorization

5.3

CVSS Rating
5.3 (Medium)

CVE-ID

CVE-2026-114699

Patch Status

Unpatched

Published
Oct 22, 2026

Affected Software

ЮKassa для WooCommerce [yookassa]

Researcher

Sanjeev Kumar

More Details >

JetBackup – Backup, Restore & Migrate <= 3.1.24.9 – Authenticated (Admin+) Arbitrary File Write

4.7

CVSS Rating
4.7 (Medium)

CVE-ID

CVE-2026-104068

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

JetBackup – Backup, Restore & Migrate [backup]

Researcher

Sarvar Eshboyev

More Details >

Contact Form by Supsystic <= 1.7.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2025-15705

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics [contact-form-by-supsystic]

Researcher

Hanif Naufal Rahman

More Details >

Speed Optimizer – The All-In-One Performance-Boosting Plugin < 7.8.5 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
4.4 (Medium)

CVE-ID

CVE-2026-111737

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

Speed Optimizer – The All-In-One Performance-Boosting Plugin [sg-cachepress]

Researcher

Karthik Ramakrishnan

More Details >

Advanced Twenty Seventeen <= 1.3.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-107887

Patch Status

Unpatched

Published
Oct 21, 2026

Affected Software

Advanced Twenty Seventeen [advanced-twenty-seventeen]

Researcher

Seongwon Lee

More Details >

Backup and Staging by WP Time Capsule <= 1.22.27 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-107237

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Backup and Staging by WP Time Capsule [wp-time-capsule]

Researcher

Het Kalariya

More Details >

Car Rental Manager – Online Vehicle Booking System <= 1.5.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-112825

Patch Status

Patched

Published
Oct 21, 2026

Affected Software

Car Rental Manager – Online Vehicle Booking System [car-rental-manager]

Researcher

Ravenska Dhigna Manggala

More Details >

Download Manager <= 3.3.71 (free) & 7.5.9 (Pro) Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-86611

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Download Manager [download-manager]

Researcher

Kartik sharma

More Details >

Easy Pricing Tables <= 4.1.2 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-111947

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Pricing Table WordPress Plugin – Easy Pricing Tables [easy-pricing-tables]

Researcher

RIA Labs

More Details >

eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-114176

Patch Status

Patched

Published
Oct 21, 2026

Affected Software

eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams [eroom-zoom-meetings-webinar]

Researcher

Aarush Gaur

More Details >

eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.7.1 – Missing Authorization to Authenticated (Subscriber+) Zoom API Credential Modification

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-114175

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams [eroom-zoom-meetings-webinar]

Researcher

Aarush Gaur

More Details >

Event Tickets and Registration <= 5.30.1 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-110902

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Event Tickets and Registration [event-tickets]

Researcher

Jacek Sowiński (dzaku)

More Details >

FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses <= 2.11.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-111836

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses [fluent-community]

Researcher

Hamza Tlili

More Details >

GeoDirectory <= 2.8.193 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-113489

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory [geodirectory]

Researcher

Karthik Ramakrishnan

More Details >

GiveWP <= 4.19.0.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-111980

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

Karthik Ramakrishnan

More Details >

GiveWP <= 4.19.0.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-111981

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

GiveWP – Donation Plugin and Fundraising Platform [give]

Researcher

Hariom Singh

More Details >

InstaWP Connect <= 0.1.4.1 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-114743

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

InstaWP Connect – 1-click WP Staging & Migration [instawp-connect]

Researcher

Meher Sudhakar Abbireddi

More Details >

Interactive Content – H5P <= 1.17.9 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-112868

Patch Status

Patched

Published
Oct 21, 2026

Affected Software

Interactive Content – H5P [h5p]

Researcher

dcs

More Details >

LatePoint <= 5.7.4 – Authenticated (Agent+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-105257

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint]

Researcher

Karthik Ramakrishnan

More Details >

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses < 4.4.10 – Authenticated (Custom+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-113353

Patch Status

Unpatched

Published
Oct 20, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

Trần Văn Hoàng

More Details >

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.10 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-42690

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

Ananda Dhakal

More Details >

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.10 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-110363

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress]

Researcher

MD Mahmidul Hasan

More Details >

LiteSpeed Cache < 7.9.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-113501

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

LiteSpeed Cache [litespeed-cache]

Researcher

Karthik Ramakrishnan

More Details >

MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.1.72 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-111847

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution [marketking-multivendor-marketplace-for-woocommerce]

Researcher

Oly Hossen

More Details >

MAS Videos <= 1.3.4 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-107907

Patch Status

Unpatched

Published
Oct 21, 2026

Affected Software

MAS Videos [masvideos]

Researcher

JunHee CHO

More Details >

MasterStudy LMS WordPress Plugin – for Online Courses and Education 3.7.13 – 3.7.54 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-88849

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]

Researcher

Arman Kumar

More Details >

MB Custom Post Types & Custom Taxonomies 2.4.0 – 2.12.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-110011

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

MB Custom Post Types & Custom Taxonomies [mb-custom-post-type]

Researcher

RIA Labs

More Details >

Meta Box – A Framework for Dynamic Websites <= 5.15.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-109700

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

Meta Box – A Framework for Dynamic Websites [meta-box]

Researcher

Deva Parekh

More Details >

miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) 6.2.9 – 6.3.0 – Two-Factor Authentication Bypass

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-111949

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) [miniorange-2-factor-authentication]

Researcher

RIA Labs

More Details >

Moloni <= 5.0.13 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-106932

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Moloni [moloni]

Researcher

Seongwon Lee

More Details >

News Kit Addons For Elementor <= 1.4.7 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-97353

Patch Status

Unpatched

Published
Oct 21, 2026

Affected Software

News Kit Addons For Elementor [news-kit-elementor-addons]

Researcher

Usama Arshad

More Details >

News Kit Addons For Elementor <= 1.4.8 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-97352

Patch Status

Patched

Published
Oct 21, 2026

Affected Software

News Kit Addons For Elementor [news-kit-elementor-addons]

Researcher

Usama Arshad

More Details >

Participants Database <= 2.7.8.5 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-112861

Patch Status

Unpatched

Published
Oct 20, 2026

Affected Software

Participants Database [participants-database]

Researcher

Tarcísio Luchesi

More Details >

Photo Engine <= 6.5.7 – Authenticated (Author+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-111972

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

Photo Engine (Media Organizer & Lightroom) [wplr-sync]

Researcher

Mahammad Mammadov

More Details >

Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred <= 4.0.0-beta.1 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-114698

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred [mycred]

Researcher

MYUNGYONG LEE

More Details >

PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 3.1.0 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-114182

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

PowerPack Addons for Elementor: Widgets, Form Styler and Templates [powerpack-lite-for-elementor]

Researcher

yzx001

More Details >

Productive Commerce <= 1.1.48 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-109926

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Productive Commerce – Wishlist, Compare & MiniCart [productive-commerce]

Researcher

Daniel Dhaniswara

More Details >

Profile Builder 4.0.0 – 4.0.4 – Authenticated (Subscriber+) Comment reCAPTCHA Protection Bypass

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-111965

Patch Status

Patched

Published
Oct 21, 2026

Affected Software

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]

Researcher

Naoki Kawahigashi

More Details >

SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher < 5.3.5 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-114120

Patch Status

Unpatched

Published
Oct 21, 2026

Affected Software

SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher [wp-scheduled-posts]

Researcher

buiih

More Details >

Sensei LMS – Online Courses, Quizzes, & Learning <= 4.26.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-112328

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Sensei LMS – Online Courses, Quizzes, & Learning [sensei-lms]

Researcher

Ikram-4

More Details >

Sensei LMS – Online Courses, Quizzes, & Learning <= 4.26.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-112329

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Sensei LMS – Online Courses, Quizzes, & Learning [sensei-lms]

Researcher

Ikram-4

More Details >

Simple Shopping Cart 5.1.3 – 5.3.2 – Authenticated (Contributor+) Payment Bypass

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-104642

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Simple Shopping Cart [wordpress-simple-paypal-shopping-cart]

Researcher

Haemanth VJ

More Details >

SmartyParcel (WC Ukr Shipping) <= 1.23.3 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-107788

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

SmartyParcel – DHL Express, GLS, InPost & Nova Post for WooCommerce [wc-ukr-shipping]

Researcher

Andy Urlep

More Details >

Strong Testimonials <= 3.3.14 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-112843

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Strong Testimonials [strong-testimonials]

Researcher

mroccon

More Details >

Subscribe to Comments 2.3 – 2.3.2 – Authenticated (Author+) Arbitrary Email Header Injection

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-91831

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

Subscribe to Comments [subscribe-to-comments]

Researcher

Het Kalariya

More Details >

SureDash – Community, Courses & Member Dashboard <= 1.12.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-110892

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

SureDash – Community, Courses & Member Dashboard [suredash]

Researcher

yzx001

More Details >

Surfer – WordPress Plugin <= 1.8.0.744 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-112222

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Surfer – WordPress Plugin [surferseo]

Researcher

Mor Golan

More Details >

Tailored Tools <= 3.0.3 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-111401

Patch Status

Patched

Published
Oct 21, 2026

Affected Software

Tailored Tools [tailored-tools]

Researcher

Oly Hossen

More Details >

VikRentCar Car Rental Management System <= 1.4.8 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-112836

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

VikRentCar Car Rental Management System [vikrentcar]

Researcher

Ayukiab

More Details >

VR 8.3.0 – 9.0.2 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-114742

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress [wpvr]

Researcher

Huseyn Huseynov

More Details >

VR 8.5.55 – 9.1.2 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-114740

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress [wpvr]

Researcher

an7ln

More Details >

VR 9.0.0 – 9.0.2 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-114741

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress [wpvr]

Researcher

RIA Labs

More Details >

WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.25 – Missing Authorization

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-112823

Patch Status

Patched

Published
Oct 20, 2026

Affected Software

WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory [wp-user-manager]

Researcher

ssophiz

More Details >

WPZOOM Portfolio <= 1.4.33 – Authenticated (Contributor+) Insecure Direct Object Reference

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-110514

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

WPZOOM Portfolio Lite – Filterable Portfolio Plugin [wpzoom-portfolio]

Researcher

Huseyn

More Details >

Xpro Addons — 150+ Widgets for Elementor <= 1.7.10 – Cross-Site Request Forgery

4.3

CVSS Rating
4.3 (Medium)

CVE-ID

CVE-2026-114177

Patch Status

Patched

Published
Oct 22, 2026

Affected Software

Xpro Addons — 150+ Widgets for Elementor [xpro-elementor-addons]

Researcher

beopseong.kim

More Details >

AI Engine <= 3.8.5 – Missing Authorization

2.7

CVSS Rating
2.7 (Low)

CVE-ID

CVE-2026-110982

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini [ai-engine]

Researcher

Anatoly Gorbounov

More Details >

Download Monitor < 5.3.5 – Missing Authorization

2.7

CVSS Rating
2.7 (Low)

CVE-ID

CVE-2026-112219

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

Download Monitor [download-monitor]

Researcher

Karthik Ramakrishnan

More Details >

Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.8.7 – Missing Authorization

2.7

CVSS Rating
2.7 (Low)

CVE-ID

CVE-2026-110537

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]

Researcher

Muni Nitish Kumar Yaddala

More Details >

Speed Optimizer – The All-In-One Performance-Boosting Plugin < 7.8.5 – Missing Authorization

2.7

CVSS Rating
2.7 (Low)

CVE-ID

CVE-2026-111738

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

Speed Optimizer – The All-In-One Performance-Boosting Plugin [sg-cachepress]

Researcher

Karthik Ramakrishnan

More Details >

Uncanny Toolkit for LearnDash <= 3.8.1 – Missing Authorization

2.7

CVSS Rating
2.7 (Low)

CVE-ID

CVE-2026-107128

Patch Status

Patched

Published
Oct 19, 2026

Affected Software

Uncanny Toolkit for LearnDash [uncanny-learndash-toolkit]

Researcher

Muni Nitish Kumar Yaddala

More Details >

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.5 – Missing Authorization

2.7

CVSS Rating
2.7 (Low)

CVE-ID

CVE-2026-111982

Patch Status

Patched

Published
Oct 23, 2026

Affected Software

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder]

Researcher

Szymon Szymkowiak

More Details >